Every request to the Roboflow API and to Roboflow Inference is authenticated. This section explains the credential types Roboflow offers, when to use each, and where to find the IDs your requests need.
Find your API key at app.roboflow.com/settings/api.
Credential types
Roboflow supports several kinds of credentials, each suited to a different context:
- Private API key - the default workspace credential. It grants full access to your workspace's data, models, and projects, so treat it like a password and keep it server-side. Use it for the REST API, Python SDK, CLI, and self-hosted Inference. See Find Your Roboflow API Key.
- Publishable key - a non-secret credential of the form
rf_<workspaceId>, safe to embed in browser or edge code such as inferencejs. It is inference- and model-download-only and cannot be rotated or revoked because it is derived from the workspace ID. See The Publishable Key. - Scoped API keys - Enterprise credentials restricted to specific permissions (for example, run inference but not manage models) and optionally to specific project folders. See Scoped API Keys.
- OAuth 2.1 (Sign in with Roboflow) - let users sign in to your application with their Roboflow account and grant your app scoped access on their behalf, using the authorization-code flow with PKCE. See Sign In With Roboflow (Getting Started).
Managing keys
- Find Your Roboflow API Key - where your key lives, private vs. publishable, and rolling a compromised key.
- Manage API Keys - create, list, update, protect, disable, and revoke keys programmatically via the REST API, the
roboflow api-keyCLI, or the MCP server. - Scoped API Keys - issue Enterprise keys limited to specific permissions.
Sign in with Roboflow (OAuth)
- Sign In With Roboflow (Getting Started) - register an OAuth app, run the PKCE flow, exchange and refresh tokens, and the full list of scopes.
- Sign In With Roboflow (Developer Reference) - endpoints, hosts, visibility, token endpoint authentication, errors, and a runnable example app.
- OAuth 2.1 (Sign in with Roboflow) - legacy landing page that points to the two guides above.
Finding your IDs
Most API calls need more than a key - they need to know which workspace, project, and model version to act on.
- Workspace and Project IDs - retrieve the project ID and model version number used in inference and API requests.
For the header and query-parameter formats accepted on each host, see Authenticate with the REST API. </content>